x402 Security Disclosures

Real threats caught in the x402 agent-payment economy, with on-chain proof · by PulseFeed · Changes · Observatory

18
high severity
17
medium
4
receiver hijacks
10
bait-and-switch
35
total active

Active incidents

🎣
headlessoracle.com bait and switch
the price it advertises differs from the amount it actually charges at payment.
on-chain proof ↗ 0x26D4Ffe9… price_bait_switch
3h ago
🎣
agents.dyoeway.org bait and switch
the price it advertises differs from the amount it actually charges at payment.
on-chain proof ↗ 0x834b189A… price_bait_switch
3h ago
🎣
lionx402.com bait and switch
the price it advertises differs from the amount it actually charges at payment.
on-chain proof ↗ 0x68e3E782… price_bait_switch
3h ago
💸
x721.dev price gouging
price is anomalously high ($40.2/call) vs the ecosystem.
on-chain proof ↗ 0x70DA5f2A… price_absurd
3h ago
💸
api.x721.dev price gouging
price is anomalously high ($40.2/call) vs the ecosystem.
on-chain proof ↗ 0x70DA5f2A… price_absurd
3h ago
💸
api.bitrefill.com price gouging
price is anomalously high ($1000/call) vs the ecosystem.
on-chain proof ↗ 0x480CD46E… price_absurd
3h ago
🔀
defidata.hergertsynthora.com payto hijack
changed its payTo receiver 0x15d3…1cc8 → 0x1080…7de0 on an established baseline — re-verify before paying.
on-chain proof ↗ 0x10800a5a… payto_changed_unconfirmed
3h ago
🎣
api.hyperextend.xyz bait and switch
the price it advertises differs from the amount it actually charges at payment.
on-chain proof ↗ 0x548fC289… price_bait_switch
1d ago
💸
api.tantra-authority.com price gouging
price is anomalously high ($29.97/call) vs the ecosystem.
on-chain proof ↗ 0xa8c3cd00… price_absurd
1d ago
🎣
api.strale.io bait and switch
the price it advertises differs from the amount it actually charges at payment.
on-chain proof ↗ 0x66D7C2F9… price_bait_switch
1d ago
🎣
mcp.gapup.io bait and switch
the price it advertises differs from the amount it actually charges at payment.
on-chain proof ↗ 0xbA1E0A29… price_bait_switch
1d ago
🎣
orionkr.xyz bait and switch
the price it advertises differs from the amount it actually charges at payment.
on-chain proof ↗ 0xd30fa341… price_bait_switch
2d ago
🎣
x402-agent-store.rileycraig14.workers.dev bait and switch
the price it advertises differs from the amount it actually charges at payment.
on-chain proof ↗ 0xc91cE629… price_bait_switch price_rising
2d ago
🎣
agenttax.io bait and switch
the price it advertises differs from the amount it actually charges at payment.
on-chain proof ↗ 0x6f4B383B… price_bait_switch
3d ago
🎣
agents.allium.so bait and switch
the price it advertises differs from the amount it actually charges at payment.
on-chain proof ↗ 0x00ad5eff… payto_rotating price_bait_switch payto_unverified_onchain
3d ago
🔀
three.ws payto hijack
changed its payTo receiver wwwwwDxFWRn7grgr3Esrsg5C6NvDoDHSA4gaCffccrU → 0x4022…f402 on an established baseline — re-verify before paying.
on-chain proof ↗ 0x4022de2d…
3d ago
🔀
dnsdomain.hergertsynthora.com payto hijack
changed its payTo receiver 0x1080…7de0 → 0x15d3…1cc8 on an established baseline — re-verify before paying.
on-chain proof ↗ 0x15d30032… payto_changed_unconfirmed
3d ago
🔀
engedi.digi-life17.workers.dev payto hijack
changed its payTo receiver 0xabc2…5a6d → 0x06b5…2189 on an established baseline — re-verify before paying.
on-chain proof ↗ 0x06b525eb…
9d ago
💸
api.anchor-x402.com price gouging
price is anomalously high ($1.77/call) vs the ecosystem.
on-chain proof ↗ 0x127462e2… price_high
3h ago
💸
x402.quicknode.com price gouging
price is anomalously high ($1/call) vs the ecosystem.
receiver not on Base — no on-chain link price_high
3h ago
💸
mcp.gapup.io price gouging
price is anomalously high ($1.5/call) vs the ecosystem.
on-chain proof ↗ 0xbA1E0A29… price_high
3h ago
💸
emc2ai.io price gouging
price is anomalously high ($1/call) vs the ecosystem.
on-chain proof ↗ 0xc9368b30… price_high
3h ago
💸
boofy.fun price gouging
price is anomalously high ($1/call) vs the ecosystem.
on-chain proof ↗ 0x2E3AB1B1… price_high
3h ago
❓
x402.browserbase.com unverified receiver
payTo 0x9B7A…1a81 has no on-chain USDC history — unconfirmed by real payments.
on-chain proof ↗ 0x9B7A2c73… payto_rotating payto_unverified_onchain
1d ago
⚠️
netintel.dev asset mismatch
requests a non-USDC or mismatched asset for the declared network.
on-chain proof ↗ 0xdaDc3354… asset_malformed
1d ago
⚠️
netintel-production-440c.up.railway.app asset mismatch
requests a non-USDC or mismatched asset for the declared network.
on-chain proof ↗ 0xdaDc3354… asset_malformed
1d ago
💸
api.myceliasignal.com price gouging
price is anomalously high ($1/call) vs the ecosystem.
on-chain proof ↗ 0xD593832C… price_high
1d ago
💸
api.cryptoetfsentinel.com price gouging
price is anomalously high ($1/call) vs the ecosystem.
on-chain proof ↗ 0x169Bf49c… price_high
1d ago
💸
tiresapi.com price gouging
price is anomalously high ($5/call) vs the ecosystem.
on-chain proof ↗ 0xF0d33a22… price_high
1d ago
❓
api.400860.xyz unverified receiver
payTo 0x0150…F3e9 has no on-chain USDC history — unconfirmed by real payments.
on-chain proof ↗ 0x01504D66… payto_unverified_onchain
1d ago
💸
gpt55.558686.xyz price gouging
price is anomalously high ($1.11112/call) vs the ecosystem.
on-chain proof ↗ 0x1f013066… price_high
1d ago
❓
api.swedata.org unverified receiver
payTo 0x9eB7…3833 has no on-chain USDC history — unconfirmed by real payments.
on-chain proof ↗ 0x9eB79ebc… payto_unverified_onchain
2d ago
💸
agi.apify.com price gouging
price is anomalously high ($1/call) vs the ecosystem.
on-chain proof ↗ 0x4aAbE17C… price_high
2d ago
💸
cheaptokens.ai price gouging
price is anomalously high ($1/call) vs the ecosystem.
on-chain proof ↗ 0x213c8d74… price_high unverifiable
2d ago
💸
x402factory.ai price gouging
price is anomalously high ($1/call) vs the ecosystem.
on-chain proof ↗ 0x402B79eC… price_high
3d ago
Why this matters — ~70% of x402 endpoints are dead or scams, and a safe endpoint can be hijacked or repriced overnight. Every incident above is derived from PulseFeed's continuous independent audit and, where the receiver is on Base, linked to on-chain proof you can verify yourself.

Verify before your agent pays: GET /trust?endpoint=<url> · Machine-readable: /incidents.json · Full dataset: PulseFeed Data API

Honesty note: categories are stated as facts from our data (e.g. "payTo has no on-chain USDC history", "advertised price ≠ amount actually charged"). We do not assert intent where it can't be proven; an "unverified receiver" or "possible hijack" is a risk signal, not a conviction. By-design receiver rotation is excluded. Window: 30 days · 35 active incidents · generated 2026-07-16T06:38:48.781Z.
Observatory · Changes · Methodology · Data API